CVE-2023-36258: PYSEC-2023-98 - An issue in langchain v.0.0.199 allows an attacker to execute arbitrary code via the PALChain in the python exec method.

CVE-2023-36258 · Severity: low · CVSS 3.1 · Published 2023-07-03

LangChain is a popular Python library for building applications with large language models (LLMs). The PALChain component, which combines LLMs with Python code execution to solve reasoning tasks, accepts user prompts that can be manipulated to inject malicious code. An attacker can craft a prompt containing commands (like `import os`) that get executed by the Python `exec()` function without sanitization, allowing arbitrary code execution on systems running vulnerable versions of LangChain.

Technologies: langchain (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2023-36258 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-36258 being exploited in the wild.
How severe is CVE-2023-36258?
Low severity, with a CVSS score of 3.1, published 3 July 2023.
Which products and versions are affected?
langchain (PyPI) ECOSYSTEM:introduced=0,fixed=0.0.247.
Is there a fix for CVE-2023-36258?
Yes. langchain (PyPI): upgrade to 0.0.247 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
Am I affected by CVE-2023-36258?
Check whether you run langchain (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • langchain (PyPI): upgrade to 0.0.247 or later
    pip install "langchain>=0.0.247"

Technical details

The vulnerability is a code injection flaw (CWE-94) in LangChain's PALChain, which uses the Python `exec()` method to execute code generated by the LLM. An attacker can inject malicious commands through user-supplied prompts that are passed to the LLM; the generated code containing these injected commands is then executed without sanitization. The attack vector is network/user-supplied input with no authentication required. Exploitation allows arbitrary code execution with the privileges of the application process. Multiple patches have been released (versions 0.0.247 and later), and mitigation PRs added input validation and safer code execution constraints.

Affected products

  • LangChain LangChain before 0.0.247

Identifiers

  • CVE-2023-36258
  • GHSA-2qmj-7962-cjq8
  • PYSEC-2023-98

Timeline

  • 2023-06-08: disclosed: Issue reported on GitHub
  • 2023-07-03: advisory: GHSA-2qmj-7962-cjq8 published
  • 2023-07-03: patched: Fix released in version 0.0.247

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.